What should I do when I find a USB storage device?¶

A USB storage device should be treated as potential evidence before anyone connects it to a computer.

Avoid this assumption: A USB stick is harmless, self-contained and safe to inspect immediately. It may contain relevant files, deleted data, malicious software, encrypted material or a hidden function unrelated to ordinary storage.

Record where it was found, who had possession or control of it and what device or location it was associated with.

Photograph the device as found before moving it where practicable.

Capture the make, model, colour, size, labels, serial number, capacity marking, physical damage and any unusual switches, adapters or attachments.

Do not plug it into an ordinary computer simply to identify its contents.

Do not rename it, format it, scan it, copy files from it or test whether it works.

Place it in suitable evidence packaging that protects it from loss, contamination and physical damage.

Record each person who handles it and every transfer.

If the USB device was already connected when found, preserve the connected state before deciding whether to remove it. Record the host device, port, open files, applications and any visible activity.

Disconnecting it may alter the host system, terminate a process or corrupt unsaved data.

Where malware, encryption, active transfer or unusual hardware is suspected, seek specialist support.

Do not assume the person carrying the device created or controlled its contents.

Operational takeaway¶

Preserve the USB device, its location, condition and relationship to other systems, and do not connect or remove it without considering the evidential and technical consequences.